b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236

Analysis

max time kernel
136s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:18

Target

b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe
Size

79KB
MD5

21f2ae59f2bb86ea9cb01797d1deb3d9
SHA1

db4f9a2346338f219aabe43ed733b0c9dabde527
SHA256

b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236
SHA512

4a9e8eb158257ee94fbcb6a90a65e1d6772a8cc59af76ccabc3bd165825f5ac59dd29b8e38929ec647c08009a293e4b526e2403e832bb4e05c9d0775a203fec8
SSDEEP

1536:zvvSjrPgawlHWzMLP0OOQA8AkqUhMb2nuy5wgIP0CSJ+5y2B8GMGlZ5G:zvvSj8aKHWgLP0bGdqU7uy5w9WMy2N5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

3024 [email protected]

pid	process
3024	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.execmd.exe

description	pid	process	target process
PID 5072 wrote to memory of 3076	5072	b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe	cmd.exe
PID 5072 wrote to memory of 3076	5072	b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe	cmd.exe
PID 5072 wrote to memory of 3076	5072	b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe	cmd.exe
PID 3076 wrote to memory of 3024	3076	cmd.exe	[email protected]
PID 3076 wrote to memory of 3024	3076	cmd.exe	[email protected]
PID 3076 wrote to memory of 3024	3076	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe
"C:\Users\Admin\AppData\Local\Temp\b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c [email protected]
2⤵
- Suspicious use of WriteProcessMemory
PID:3076

C:\Users\Admin\AppData\Local\Temp\[email protected]
[email protected]
3⤵
- Executes dropped EXE
PID:3024

C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize
79KB

MD5
afb755a252ada2516e53a4279544cfe2

SHA1
366ebf4c1c609e0f6bd25e62f8417c48f13fd826

SHA256
250957582285c494a4cfba8e856619a7814bd966352ff196339aeb2e4785c84b

SHA512
18476be1b3d45620d7822e2301e99322c38483f88abe0f86adbdb0cef351e67d0ff79e6a444c19266124ace21531ca589e15c37f5f368a6a0e6faac84308929a

Download Submit
memory/3024-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5072-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download